Merge branch 'change_ff_definition' into 'master'

Provide different method for checking block_password_auth_for_saml_users feature flag

See merge request gitlab-org/gitlab!61026

ee/app/models/ee/user.rb

@@ -328,11 +328,11 @@ module EE
     end
 
     def user_authorized_by_provisioning_group?
-      ::Feature.enabled?(:block_password_auth_for_saml_users, type: :ops) && user_detail.provisioned_by_group?
+      user_detail.provisioned_by_group? && ::Feature.enabled?(:block_password_auth_for_saml_users, user_detail.provisioned_by_group, type: :ops)
     end
 
     def authorized_by_provisioning_group?(group)
-      ::Feature.enabled?(:block_password_auth_for_saml_users, type: :ops) && provisioned_by_group == group
+      user_authorized_by_provisioning_group? && provisioned_by_group == group
     end
 
     def gitlab_employee?

ee/spec/models/ee/user_spec.rb

@@ -816,8 +816,10 @@ RSpec.describe User do
 
   describe '#user_authorized_by_provisioning_group?' do
     context 'when user is provisioned by group' do
+      let(:group) { build(:group) }
+
       before do
-        user.user_detail.provisioned_by_group = build(:group)
+        user.user_detail.provisioned_by_group = group
       end
 
       it 'is true' do
@@ -833,6 +835,24 @@ RSpec.describe User do
           expect(user.user_authorized_by_provisioning_group?).to eq false
         end
       end
+
+      context 'with feature flag switched on for particular groups' do
+        before do
+          stub_feature_flags(block_password_auth_for_saml_users: false)
+        end
+
+        it 'is false when provisioned by group without feature flag' do
+          stub_feature_flags(block_password_auth_for_saml_users: create(:group))
+
+          expect(user.user_authorized_by_provisioning_group?).to eq false
+        end
+
+        it 'is true when provisioned by group with feature flag' do
+          stub_feature_flags(block_password_auth_for_saml_users: group)
+
+          expect(user.user_authorized_by_provisioning_group?).to eq true
+        end
+      end
     end
 
     context 'when user is not provisioned by group' do